Embodiments of the present invention generally relate to web application security scanners and more specifically to web application security scanners capable of detecting session state and capable of automatically logging into a web site.
Web application security is important for businesses that maintain web sites. Unauthorized access to a web site may allow user identities to be stolen, allow personal user information to be accessed without authorization, etc. This may cause many problems for businesses. Also, unauthorized attacks may affect a web site's availability.
In order to protect against unauthorized access, a security analysis of the web site may be performed. This may include scanning the web site to determine any vulnerabilities that may exist. The scanning typically ignores significant aspects of the web site functionality. For example, the scanner may not be allowed to access certain areas of the site if they are protected. Accordingly, the scanner may not be able to reliably test significant portions of the web site functionality. Thus, a security analysis may not be complete and reliable.